Actually after another try for an attack 3 years later I now went for approval 50-80, and block 50.
Stripe radar and the nginx rate limiting will do.
And another thing, they tend to use disposable email addresses, so just confirming email works is not helping much. Of course they would not know in that case that there is a credit card form hidden. It worked well enough without a captcha however. As long as your website is harder to attack than others that’s enough. So strict Stripe radar and rate limiting the checkout page is good enough to deter card testers.
PayPal seems to have something similar to stripe radar too now, I don’t know because I use button payments only and then the problem is shifted to PayPal as they checkout on Paypal website. It’s rather that PayPal is unnecessary strict and blocks much more than I do with the rules above for people trying to pay without PayPal account.
With strict radar rules the card testers will actually have legitimate numbers shown as not working so it undermines their efforts. Because they will never know why their payment didn’t go through. Was it the CVC or the address or the zip code or their IP or their email.
Btw i don’t block disposable email because I quite often have legitimate users using them for data security. It’s a bit of a pain afterwards for me but quite likely blocking disposable email would lose me half of them in first place. As a small website this is hard to prevent.
